Authorization

To use the API, you need to authenticate your requests using an API token.

Getting Your API Token

1. Go to https://cart.easy.tools/creator/store-settings/developer
2. Generate a new API token
3. Copy and securely store your token

An API token belongs to your user account, not to a single store. It works with your own store and with any store whose team granted you the Use the Easycart API permission — see Store selection below.

Using the API

Base URL

All API requests should be made to:

https://cart.easy.tools/api/v1

Authentication

Include your API token in the Authorization header using Bearer authentication:

Authorization: Bearer YOUR_API_TOKEN

It's important to also include these headers in all requests:

Content-Type: application/json
Accept: application/json

Example Request

curl -H "Authorization: Bearer YOUR_API_TOKEN" \
     -H "Content-Type: application/json" \
     -H "Accept: application/json" \
     https://cart.easy.tools/api/v1/endpoint

Store Selection

Every request operates on exactly one store. Without any extra headers, requests target your default store — for most users, the store they own.

If your token has access to more than one store, pass the store's ID in the X-Easycart-Store header to direct the request at that store:

X-Easycart-Store: 550e8400-e29b-41d4-a716-446655440000

Store IDs come from List stores, which returns every store your token can reach and marks the default one. A store grants or revokes API access through its team role permissions; revoking takes effect immediately on the next request.

Example Request

curl -H "Authorization: Bearer YOUR_API_TOKEN" \
     -H "X-Easycart-Store: 550e8400-e29b-41d4-a716-446655440000" \
     -H "Content-Type: application/json" \
     -H "Accept: application/json" \
     https://cart.easy.tools/api/v1/orders

Access Errors (403 Forbidden)

Selecting a store that has not granted you API access — or that does not exist — returns 403 on any endpoint:

{
  "message": "You do not have API access to the requested store."
}

When the header is omitted and your default store has not granted you API access, the 403 asks for an explicit selection instead:

{
  "message": "You do not have API access to this store. Pass the X-Easycart-Store header to select a store you have API access to."
}

Rate Limiting

The API enforces rate limiting per store:

• 100 requests per 60 seconds

Rate Limit Headers

All responses include rate limit information:

Header	Description
X-RateLimit-Limit	Maximum requests allowed in the window

When rate limited, additional headers are included:

Header	Description
X-RateLimit-Remaining	Requests remaining (always 0 when limited)
Retry-After	Seconds until the rate limit resets

Rate Limit Error (429 Too Many Requests)

{
  "message": "Too many requests. Please retry after 60 seconds."
}